Miscellaneous plugins not yet categorized.

alertFunctionGenerate an alert message
allFunctionReturns TRUE if all items are true
anyFunctionReturns TRUE if any items are true
artifact_set_metadataFunctionSets metadata about the artifact
base85decodeFunctionDecode a base85 encoded string
client_createFunctionCreate a new client in the data store
create_notebook_downloadFunctionCreates a notebook export zip file
delayPluginExecutes ‘query’ and delays relaying the rows by the specified number of seconds
delete_eventsPluginDelete all the files that make up a flow
delete_flowPluginDelete all the files that make up a flow
efivariablesPluginEnumerate efi variables
entropyFunctionCalculates shannon scale entropy of a string
etw_sessionsPluginEnumerates all active ETW sessions
flow_logsPluginRetrieve the query logs of a flow
get_flowFunctionGets flow details
gunzipFunctionUncompress a gzip-compressed block of data
hunt_deletePluginDelete a hunt
hunt_updateFunctionUpdate a hunt
leveldbPluginEnumerate all items in a level db database
loggingPluginWatch the logs emitted by the server
logscale_uploadPluginUpload rows to LogScale ingestion server
lruFunctionCreates an LRU object
lzxpress_decompressFunctionDecompress an lzxpress blob
mailFunctionSend Email to a remote server
mock_clearFunctionResets all mocks
mock_replayFunctionReplay recorded calls on a mock
monitoring_logsPluginRetrieve log messages from client event monitoring for the specified client id and artifact
orgFunctionReturn the details of the current org
org_createFunctionCreates a new organization
org_deleteFunctionDeletes an Org from the server
orgsPluginRetrieve the list of orgs on this server
passwdFunctionUpdates the user’s password
pe_dumpFunctionDump a PE file from process memory
pk_decryptFunctionDecrypt files using pubkey encryption
pk_encryptFunctionEncrypt files using pubkey encryption
process_trackerFunctionInstall a global process tracker
process_tracker_allFunctionGet all processes stored in the tracker
process_tracker_callchainFunctionGet a call chain from the global process tracker
process_tracker_childrenFunctionGet all children of a process
process_tracker_getFunctionGet a single process from the global tracker
process_tracker_pslistPluginList all processes from the process tracker
process_tracker_treeFunctionGet the full process tree under the process id
process_tracker_updatesPluginGet the process tracker update events from the global process tracker
profile_goroutinesPluginEnumerates all running goroutines
profile_memoryPluginEnumerates all in use memory within the runtime
pskillFunctionKill the specified process
queryPluginEvaluate a VQL query
read_crypto_filePluginRead a previously stored encrypted local storage file
rekeyFunctionCauses the client to rekey and regenerate a new client ID
remapFunctionApply a remapping configuration to the root scope
repackFunctionRepack and upload a repacked binary or MSI to the server
server_frontend_certFunctionGet Server Frontend Certificate
sigmaPluginEvaluate sigma rules
sigma_log_sourcesFunctionConstructs a Log sources object to be used in sigma rules
sysinfoFunctionCollect system information on Linux clients
tlsh_hashFunctionCalculate the tlsh hash of a file
traceFunctionUpload a trace file
upload_azureFunctionUpload files to Azure Blob Storage Service
upload_smbFunctionUpload files using the SMB file share protocol
userFunctionRetrieves information about the Velociraptor user
user_grantFunctionGrants the user the specified roles
vfs_lsPluginList directory and build a VFS object
write_crypto_filePluginWrite a query into an encrypted local storage file
write_jsonlPluginWrite a query into a JSONL file
xattrFunctionQuery a file for the specified extended attribute